[Bug 295856] dns/powerdns update to 5.1.1 with automatic authenticated DNSSEC Bootstrapping in PowerDNS Authoritative

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=295856

Jordan Ostreff <jordan@ostreff.info> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
 Attachment #271655|0                           |1
        is obsolete|                            |
 Attachment #271655|maintainer-approval?        |
              Flags|                            |

--- Comment #4 from Jordan Ostreff <jordan@ostreff.info> ---
Created attachment 271889
  --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=271889&action=edit
dns/powerdns: Modernize build system using Meson, fix dependencies and expose
hidden features

This patch thoroughly refactors and modernizes the build integration for
dns/powerdns (Authoritative Server), migrating the port from the legacy
Autotools framework to the modern Meson build system framework. 

It aligns the port with upstream's structural architecture, fixes invalid
configuration arguments triggered by build system evolutions, eliminates
trailing Linux-specific systemd build remnants, and exposes hidden options
natively discovered by Meson.

### Summary of Changes:
* **Framework Migration:** Converted the port from `USES=gmake autoreconf` to
`USES=meson python:build`.
* **Linux Dependency Sandbox Fix:** Explicitly configured core parameters to
prevent unauthorized host scanning. Dropped the obsolete systemd unit matching
constraints to align with version 5.1.1.
* **Build System Flag Alignments:** Fixed broken and ignored build
configuration definitions across several port options to conform with modern
`meson_options.txt` syntax:
  * Integrated `GNUTLS_MESON_ENABLED= tls-gnutls`.
  * Integrated `IXFRDIST_MESON_TRUE= tools-ixfrdist`.
* **Feature Exposure (New Options exposed):**
  * Introduced **`GSSAPI`** option to control GSS-API/Kerberos authentication
layer hooks for TSIG secure zone transfers (bound via `gssapi:mit`).
  * Introduced **`P11KIT`** option to gracefully handle conditional mappings
for native PKCS#11 / Hardware Security Modules (HSM) crypt-signing capabilities
using `sysutils/p11-kit`.
* **Code Cleanups:** Re-sorted options, descriptions, and structural
conditional logic alphabetically to strictly adhere to `portfmt` and Ports
Collection framework styling policies.

---

### Why Migrate to the Meson Build Variant? (Recommendation & Benefits)

Migrating the `dns/powerdns` port to Meson provides critical advantages for
both maintainers and end-users on FreeBSD:

1. **Strict Dependency Isolation (Sandboxing):**
   The legacy Autotools configuration frequently suffered from "implicit
dependency bleeding", where the configure script would silently auto-detect and
link against libraries installed on the host system (e.g., GnuTLS or Kerberos),
even if the user explicitly disabled them in `make config`. Meson enforces
strict explicit configuration—if a feature is not requested, its detection is
hard-disabled, guaranteeing reproducible package builds across different
Poudriere environments.

2. **Deterministic Module Compilation:**
   PowerDNS has transitioned its backends into modular structures. By switching
to Meson, the port cleanly defines `-Dmodule-<backend>=dynamic` routines. This
allows seamless compilation of independent dynamic shared objects (`.so`)
without risking dependency collision during complex link stages.

3. **Massive Build Performance Gains:**
   Meson combined with the `ninja` backend provides an optimal parallel build
graph. This significantly cuts down compilation and configuration times
compared to legacy `gmake` cycles, reducing infrastructure load during massive
port package runs.

---

### New Capabilities and Options Unlocked

This modernization brings the FreeBSD port to parity with upstream features by
offering:

* **Native DoT (DNS over TLS) with GnuTLS Toggle:** Users can now cleanly
isolate GnuTLS support via the `GNUTLS` option knob for secure transport
handling in ancillary tools like `sdig`.
* **Hardware Security Module (HSM) Native Hooks:** The inclusion of the
`P11KIT` option enables cryptographic hardware signing acceleration (PKCS#11)
for production DNSSEC environments.
* **GSS-TSIG Secure Zone Transfers:** The `GSSAPI` knob bridges PowerDNS with
modern enterprise environments running Kerberos/Active Directory
infrastructures, ensuring authenticated and secure dynamic zone updates (RFC
3645).
* **Granular Utility Packages:** Extra binaries such as `dnsdemog` and `kvresp`
are now correctly bundled via the underlying `TOOLS` build flags.

### QA Results:
* `make config` displays clean layouts with freshly isolated conditional knobs.
* Build and staging cycles tested successfully under isolated workloads using
Clang 21.

-- 
You are receiving this mail because:
You are the assignee for the bug.